Fix debug build break by using pc-relative code on ComputeCodeStartAddress

R=joransiu@ca.ibm.com

Change-Id: I81c3a3e220c9f4f90772bcb39f1a9b9d48661e19
Reviewed-on: https://chromium-review.googlesource.com/1222606Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#55840}

This reverts commit a03cec2c.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/21320

Original change's description:
> Reland "[objects] Change String::length field to uint32_t."
> 
> This is a reland of 1f1eb625, the
> breakage on the GCStress bot seems to be unrelated (maybe flushed
> out by this change). We decided to reland to figure out whether it's
> a random flake or really triggered by this particular change.
> 
> Original change's description:
> > [objects] Change String::length field to uint32_t.
> >
> > This changes the Name::hash_field and Symbol::flags to uint32_t as
> > well, so that both Symbols and Strings consume one fewer word on 64-bit
> > architectures now. More importantly the access to String::length is
> > always a 32-bit field load now, even with 31-bit Smis (i.e. on ARM or
> > on 64-bit with pointer compression), so the access should be faster.
> >
> > Bug: v8:7065, v8:8171
> > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> > Change-Id: I5523deb1f84ece91fa2fea775d50318bd1300493
> > Reviewed-on: https://chromium-review.googlesource.com/1221288
> > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55825}
> 
> Bug: v8:7065, v8:8171
> Tbr: tebbi@chromium.org, yangguo@chromium.org, ishell@chromium.org, ulan@chromium.org
> Change-Id: I2be24ac018591c04c826e7e8db82e007b738d156
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/1222308
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55838}

TBR=yangguo@chromium.org,tebbi@chromium.org,ishell@chromium.org,bmeurer@chromium.org

Change-Id: Ic741c3d407d4257a8c86b3082b9a19e33dc89215
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7065, v8:8171
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1222368Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55839}

This is a reland of 1f1eb625, the
breakage on the GCStress bot seems to be unrelated (maybe flushed
out by this change). We decided to reland to figure out whether it's
a random flake or really triggered by this particular change.

Original change's description:
> [objects] Change String::length field to uint32_t.
>
> This changes the Name::hash_field and Symbol::flags to uint32_t as
> well, so that both Symbols and Strings consume one fewer word on 64-bit
> architectures now. More importantly the access to String::length is
> always a 32-bit field load now, even with 31-bit Smis (i.e. on ARM or
> on 64-bit with pointer compression), so the access should be faster.
>
> Bug: v8:7065, v8:8171
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: I5523deb1f84ece91fa2fea775d50318bd1300493
> Reviewed-on: https://chromium-review.googlesource.com/1221288
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55825}

Bug: v8:7065, v8:8171
Tbr: tebbi@chromium.org, yangguo@chromium.org, ishell@chromium.org, ulan@chromium.org
Change-Id: I2be24ac018591c04c826e7e8db82e007b738d156
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1222308Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55838}

This reverts commit df6157ae.

Reason for revert: trybots didn't rerun :-/

Original change's description:
> Reland "[objects] Change String::length field to uint32_t."
> 
> This is a reland of 1f1eb625, the
> breakage on the GCStress bot seems to be unrelated (maybe flushed
> out by this change). We decided to reland to figure out whether it's
> a random flake or really triggered by this particular change.
> 
> Original change's description:
> > [objects] Change String::length field to uint32_t.
> >
> > This changes the Name::hash_field and Symbol::flags to uint32_t as
> > well, so that both Symbols and Strings consume one fewer word on 64-bit
> > architectures now. More importantly the access to String::length is
> > always a 32-bit field load now, even with 31-bit Smis (i.e. on ARM or
> > on 64-bit with pointer compression), so the access should be faster.
> >
> > Bug: v8:7065, v8:8171
> > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> > Change-Id: I5523deb1f84ece91fa2fea775d50318bd1300493
> > Reviewed-on: https://chromium-review.googlesource.com/1221288
> > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55825}
> 
> Tbr: tebbi@chromium.org, yangguo@chromium.org, ishell@chromium.org
> Bug: v8:7065, v8:8171
> Change-Id: I3c7d0b00abb15fa98ab622f9ecd8602fc798cbc3
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/1221290
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55836}

TBR=ulan@chromium.org,yangguo@chromium.org,tebbi@chromium.org,ishell@chromium.org,bmeurer@chromium.org

Change-Id: Ieaf3be31166abb02e37370ad846c38fa3d114693
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7065, v8:8171
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1222306Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55837}

This is a reland of 1f1eb625, the
breakage on the GCStress bot seems to be unrelated (maybe flushed
out by this change). We decided to reland to figure out whether it's
a random flake or really triggered by this particular change.

Original change's description:
> [objects] Change String::length field to uint32_t.
>
> This changes the Name::hash_field and Symbol::flags to uint32_t as
> well, so that both Symbols and Strings consume one fewer word on 64-bit
> architectures now. More importantly the access to String::length is
> always a 32-bit field load now, even with 31-bit Smis (i.e. on ARM or
> on 64-bit with pointer compression), so the access should be faster.
>
> Bug: v8:7065, v8:8171
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: I5523deb1f84ece91fa2fea775d50318bd1300493
> Reviewed-on: https://chromium-review.googlesource.com/1221288
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55825}

Tbr: tebbi@chromium.org, yangguo@chromium.org, ishell@chromium.org
Bug: v8:7065, v8:8171
Change-Id: I3c7d0b00abb15fa98ab622f9ecd8602fc798cbc3
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1221290
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55836}

There is no "no_reg" LiftoffRegister, so we sometimes have to
initialize it to an arbitrary value, because it will be overwritten
later anyway. One solution would be to wrap it in base::Optional, but
that does not really reflect the right semantics, since it's not
optional, but just set at a later point.
So far, we used the register with code 0, but on some platforms (e.g.
mips), register 0 is not a Liftoff cache register. So just use the
first gp cache register instead.

R=ahaas@chromium.org

Bug: chromium:883280
Change-Id: I157384ad5a9ca6a20aa198f3217a7d754dc53e30
Reviewed-on: https://chromium-review.googlesource.com/1221216
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55835}

R=machenbach@chromium.org

Bug: chromium:872257
Change-Id: I6eb1f70e0d44c76e18eb4f6f936c7f2cf0380444
Reviewed-on: https://chromium-review.googlesource.com/1217942
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55834}

This is a reland of 78f8ff95

Original change's description:
> [preparser] Refactor VariableProxies to use ThreadedLists interface
>
> Bug: v8:7926
> Change-Id: Idfc520b67696c8a838a0ee297ea392d416dd899e
> Reviewed-on: https://chromium-review.googlesource.com/1206292
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55801}

Bug: v8:7926, chromium:883059
Change-Id: Icaa496be1b4df8306fe6d623e5825909d7b0c9c5
Reviewed-on: https://chromium-review.googlesource.com/1221529
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55833}

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: I0314f1b45433c3023f803d67a056ffd6dbf83ce9
Reviewed-on: https://chromium-review.googlesource.com/1221212
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55832}

The interpreter stores a weak reference to the WasmInstance it belongs
to. Make this a phantom reference, so the GC can get rid of the
interpreter and its associated memory already on the first GC.

Drive-by: Some renamings/refactorings.

R=ahaas@chromium.org

Bug: chromium:875647
Change-Id: Ib49f6d8aa820b904f07fabe7df78ddf6df944264
Reviewed-on: https://chromium-review.googlesource.com/1221806Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55831}

Change-Id: Ib9c297c5718b418530d76d6def19c432db1180fe
Reviewed-on: https://chromium-review.googlesource.com/1219632Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55830}

Bug: v8:8015
Change-Id: Iabb051be94768e5ca570a8fa5128a3dbf66065da
Reviewed-on: https://chromium-review.googlesource.com/1221194
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55829}

 - Update those counters from space
 - Add fast path for move memory

 Fix:
 - Introduce proper variants for checked arithmetic on atomics.

Previous revert was needed to unblock other reverts.

This reverts commit 651bd0de.

Bug: chromium:845409
Change-Id: I906ef6c60a589a30a0a632eadb8642735deaf0e4
Tbr: ulan@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/1221213Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55828}

This also fixes a use where it should be a public name. For public
names, we use what is defined in the module or wasm-function[%d] as per
the wasm names spec.

Bug: v8:8015
Change-Id: Ie102db4e1114b20caeb4a990cb9e07cacf0666bc
Reviewed-on: https://chromium-review.googlesource.com/1215627Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55827}

This reverts commit 1f1eb625.

Reason for revert: GC Stress failure (https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/21311) 

Original change's description:
> [objects] Change String::length field to uint32_t.
> 
> This changes the Name::hash_field and Symbol::flags to uint32_t as
> well, so that both Symbols and Strings consume one fewer word on 64-bit
> architectures now. More importantly the access to String::length is
> always a 32-bit field load now, even with 31-bit Smis (i.e. on ARM or
> on 64-bit with pointer compression), so the access should be faster.
> 
> Bug: v8:7065, v8:8171
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: I5523deb1f84ece91fa2fea775d50318bd1300493
> Reviewed-on: https://chromium-review.googlesource.com/1221288
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55825}

TBR=yangguo@chromium.org,tebbi@chromium.org,ishell@chromium.org,bmeurer@chromium.org

Change-Id: I73f3200902f9d52e5664d48c938e37d9dfb7bce7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7065, v8:8171
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1221706Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55826}

This changes the Name::hash_field and Symbol::flags to uint32_t as
well, so that both Symbols and Strings consume one fewer word on 64-bit
architectures now. More importantly the access to String::length is
always a 32-bit field load now, even with 31-bit Smis (i.e. on ARM or
on 64-bit with pointer compression), so the access should be faster.

Bug: v8:7065, v8:8171
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I5523deb1f84ece91fa2fea775d50318bd1300493
Reviewed-on: https://chromium-review.googlesource.com/1221288
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55825}

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: I8db34b56e3dd3ac24ca7e368054829befb13397f
Reviewed-on: https://chromium-review.googlesource.com/1221187Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55824}

NOTRY=true
TBR=sigurds@chromium.org

Bug: v8:7783
Change-Id: I3c4c8222b121856a58f371e3563474e17c2075fd
Reviewed-on: https://chromium-review.googlesource.com/1221189Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55823}

BUG=v8:5402,v8:8015

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I14613a05f9b71308858afdd8d2b212ae9786abb3
Reviewed-on: https://chromium-review.googlesource.com/1215169
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55822}

No-try: true
Bug: v8:8169
Change-Id: I2ba158d3a2886c18fc4897e5172f32a2211f1a57
Reviewed-on: https://chromium-review.googlesource.com/1221286Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55821}

Most were using uint8_t already, but some were declared as int8_t. This
CL consistently makes 8-bit immediates unsigned values.

R=titzer@chromium.org

Change-Id: I8f829486fb5ab1bf597b0be1eabc9b811543c3e3
Reviewed-on: https://chromium-review.googlesource.com/1220147Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55820}

This reverts commit 78f8ff95.

Reason for revert: Causing failures on ClusterFuzz and flakes on the waterfall.
BUG: v8:8166, chromium:883042, chromium:883054, chromium:883119, chromium:883110

Original change's description:
> [preparser] Refactor VariableProxies to use ThreadedLists interface
>
> Bug: v8:7926,
> Change-Id: Idfc520b67696c8a838a0ee297ea392d416dd899e
> Reviewed-on: https://chromium-review.googlesource.com/1206292
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55801}

TBR=marja@chromium.org,cbruni@chromium.org,ishell@chromium.org,verwaest@chromium.org,sattlerf@google.com

Change-Id: Ibebff76b5ae69b9790b73c6bd1d53beff5d53673
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7926
Reviewed-on: https://chromium-review.googlesource.com/1221227Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55819}

Revert "[ptr-compr] Introduce BoundedPageAllocator and use it instead of CodeRange."

This reverts commit 16816e53.

Revert "[cleanup] Introduce LsanPageAllocator decorator"

This reverts commit 0606bf91.

Revert "[ptr-compr][heap] Fix TODOs about always using proper page allocator"

This reverts commit b0edf8e6.

The fist CL in the list is suspected to block the roll:
https://chromium-review.googlesource.com/c/chromium/src/+/1216022

Pseudo bisect points to that CL:
https://chromium-review.googlesource.com/c/chromium/src/+/1219612

TBR=ishell@chromium.org

Bug: v8:8096
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I9fafedd3810e14cdfc2068df7727cf90fc0cc85a
Reviewed-on: https://chromium-review.googlesource.com/1219695
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55818}

This is a reland of 6afe7d18.
The reason for the revert is fixed in https://crrev.com/c/1219633.

Original change's description:
> [Liftoff] Implement f32.copysign and f64.copysign
>
> These are two of the few missing instructions. This CL implements them
> for ia32 and x64, and bails out on other platforms.
> On x64, we are using the BTR instruction since we cannot have 64-bit
> immediates.
>
> Drive-by: Fix naming of existing bt/bts instructions on x64.
>
> R=titzer@chromium.org
>
> Bug: v8:6600
> Change-Id: Ib8532ca811160cd61f4ba7c06b04ce093861c872
> Reviewed-on: https://chromium-review.googlesource.com/1174383
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55780}

Bug: v8:6600
Change-Id: Ie14ba3a14848ba8e67f97e66d3379178f35dea40

TBR=titzer@chromium.org

Change-Id: Ie14ba3a14848ba8e67f97e66d3379178f35dea40
Reviewed-on: https://chromium-review.googlesource.com/1219693Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55817}

This reverts commit 9d5ab51f.

Reason for revert: Blocks important revert. Also rolling is down
since 2 days... so please wait with relanding until rolling is
confirmed to be up again.
https://chromium-review.googlesource.com/c/v8/v8/+/1219695

Original change's description:
> Reland "[heap] Introduce backing store counters on Heap"
> 
> - Update those counters from space
> - Add fast path for move memory
> 
> Fix:
> - Introduce proper variants for checked arithmetic on atomics.
> 
> This reverts commit 0c62f5b3.
> 
> Bug: chromium:845409
> Change-Id: I98ad1a7c470c7e7b805e087b4ec74e3451344712
> Reviewed-on: https://chromium-review.googlesource.com/1219647
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55815}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ifb7c6e31f7f105bd11d1497a1061f73d42c05c31
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:845409
Reviewed-on: https://chromium-review.googlesource.com/1221186Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55816}

- Update those counters from space
- Add fast path for move memory

Fix:
- Introduce proper variants for checked arithmetic on atomics.

This reverts commit 0c62f5b3.

Bug: chromium:845409
Change-Id: I98ad1a7c470c7e7b805e087b4ec74e3451344712
Reviewed-on: https://chromium-review.googlesource.com/1219647Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55815}

Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: I2ac8b12c040af2ad6122ce14eef8b4f8375e46ac
Reviewed-on: https://chromium-review.googlesource.com/1219708Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55814}

This reverts commit f0f5f877.

Reason for revert: Merge conflict (does not compile).

Original change's description:
> Reland "[Liftoff] Implement f32.copysign and f64.copysign"
> 
> This is a reland of 6afe7d18.
> The reason for the revert is fixed in https://crrev.com/c/1219633.
> 
> Original change's description:
> > [Liftoff] Implement f32.copysign and f64.copysign
> >
> > These are two of the few missing instructions. This CL implements them
> > for ia32 and x64, and bails out on other platforms.
> > On x64, we are using the BTR instruction since we cannot have 64-bit
> > immediates.
> >
> > Drive-by: Fix naming of existing bt/bts instructions on x64.
> >
> > R=titzer@chromium.org
> >
> > Bug: v8:6600
> > Change-Id: Ib8532ca811160cd61f4ba7c06b04ce093861c872
> > Reviewed-on: https://chromium-review.googlesource.com/1174383
> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Ben Titzer <titzer@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55780}
> 
> Bug: v8:6600
> Change-Id: I4baeec6b02b17450988cfa7fedd5037f9cfe1638
> Reviewed-on: https://chromium-review.googlesource.com/1219508
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55812}

TBR=titzer@chromium.org,clemensh@chromium.org

Change-Id: Iae075a8f5225f1678691698bf3a304faa5ae2aab
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6600
Reviewed-on: https://chromium-review.googlesource.com/1220747Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55813}

This is a reland of 6afe7d18.
The reason for the revert is fixed in https://crrev.com/c/1219633.

Original change's description:
> [Liftoff] Implement f32.copysign and f64.copysign
>
> These are two of the few missing instructions. This CL implements them
> for ia32 and x64, and bails out on other platforms.
> On x64, we are using the BTR instruction since we cannot have 64-bit
> immediates.
>
> Drive-by: Fix naming of existing bt/bts instructions on x64.
>
> R=titzer@chromium.org
>
> Bug: v8:6600
> Change-Id: Ib8532ca811160cd61f4ba7c06b04ce093861c872
> Reviewed-on: https://chromium-review.googlesource.com/1174383
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55780}

Bug: v8:6600
Change-Id: I4baeec6b02b17450988cfa7fedd5037f9cfe1638
Reviewed-on: https://chromium-review.googlesource.com/1219508Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55812}

NOTRY=true
TBR=herhut@chromium.org

Bug: v8:8164
Change-Id: I6748a6fc58c9910855f018cccc1d93a40d8c32ad
Reviewed-on: https://chromium-review.googlesource.com/1219692Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55811}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b34c179..107ec0d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c80faf4..134ee36

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/727453b..0425ebd

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e9dadb9..f59512e

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I7656b828f0cbc6fb6240f898f828b13a9fdb75e8
Reviewed-on: https://chromium-review.googlesource.com/1220889
Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#55810}

https://github.com/nodejs/node/issues/21038

Change-Id: Ic4c9f403b5e54a97d3170b2311dd5aab8c8357c8
Reviewed-on: https://chromium-review.googlesource.com/1217726
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55809}

This will give us some clusterfuzz coverage.

Bug: v8:7869
Change-Id: Ia93b4f4f8b76011a73405788ad940059467d9114
Reviewed-on: https://chromium-review.googlesource.com/1220292Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55808}

This reverts commit 9c67143f.

Reason for revert: Potential cause of mac gpu failures for the auto roller - https://ci.chromium.org/p/chromium/builders/luci.chromium.try/mac_optional_gpu_tests_rel/9158

Original change's description:
> [heap] Introduce backing store counters on Heap
> 
> - Update those counters from space
> - Add fast path for move memory
> 
> Bug: chromium:845409
> Change-Id: Icd72e551df2422a635801fb4e31588073f81544e
> Reviewed-on: https://chromium-review.googlesource.com/1219707
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55798}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Iaa0d375d84f1c559a13dea9b9f1b7f6907cbd768
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:845409
Reviewed-on: https://chromium-review.googlesource.com/1220293Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55807}

The CSA implementation is a separate handler so that TF has the
opportunity to reduce to a direct call, skipping some of the dispatching
in the CloneObjectIC stub.

This patch moves the looping over a source object's keys and values into the
base CodeStubAssembler, so that it can be shared between ObjectAssignFast
and CloneObjectIC_Slow.

During each step of the loop, storing is delegated to a new SetPropertyInLiteral
helper in KeyedStoreGenericGenerator, which performs a store without consulting
the prototype chain, and automatically reconfigures accessors into data
properties regardless of their attributes.

BUG=v8:8067, v8:7611
R=ishell@chromium.org, jkummerow@chromium.org

Change-Id: I06ae89f37e9b4265aab67389cf68a96529f90578
Reviewed-on: https://chromium-review.googlesource.com/1182122
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55806}

Bug: v8:5751
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I91a7305d82423d3a7b1d2fc44282b6116c4c746c
Reviewed-on: https://chromium-review.googlesource.com/1208652
Commit-Queue: Ujjwal Sharma <usharma1998@gmail.com>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55805}

- Introduce Token::IsLiteral helper
- Introduce Token::IsStrictReservedWord helper


Drive-by-fix:
- Use "token" instead of "tok" as variable name
- Keep enum order consistent accross files

Change-Id: Ie3b30a62dfbea761a31c32465c0afa681d326710
Reviewed-on: https://chromium-review.googlesource.com/1203952Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55804}

We had an optimization in Crankshaft where we would call into the
megamorphic handler stub directly if an inline cache was already
found to be megamorphic when it hit the optimizing compiler. This
way we could avoid the dispatch overhead when we know that there's
no point in checking for the other states anyways. However we somehow
missed to port this optimization to TurboFan.

Now this change introduces support to call into LoadIC_Megamorphic and
KeyedLoadIC_Megamorphic directly (plus the trampoline versions), which
saves quite a lot of overhead for the cases where the map/name pair is
found in the megamorphic stub cache, and it's quite a simple change. We
can later extend this to also handle the StoreIC and KeyedStoreIC cases
if that turns out to be beneficial.

This improves the score on the Octane/TypeScript test by around ~2%
and the TypeScript test in the web-tooling-benchmark by around ~4%. On
the ARES-6 Air test the steady state mean improves by 2-4%, and on the
ARES-6 ML test the steady state mean seems to also improve by 1-2%, but
that might be within noise.

On a micro-benchmark that just runs `o.x` in a hot loop on a set of 9
different objects, which all have `x` as the first property and are
all in fast mode, we improve by around ~30%, and are now almost on par
with JavaScriptCore.

Bug: v8:6344, v8:6936
Change-Id: Iaa4c6e34c37e78da217ee75f32f6acc95a834250
Reviewed-on: https://chromium-review.googlesource.com/1215623Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55803}

This reverts commit ece86adc.

Reason for revert: Potential cause of auto-roller breakage https://ci.chromium.org/p/chromium/builders/luci.chromium.try/win10_chromium_x64_rel_ng/91864

Original change's description:
> [typedarray] Properly convert hole to undefined in TypedArray.from
> 
> It used to call the old IterableToList, which had the wrong
> semantics for holes.
> 
> Bug: v8:8133
> Change-Id: Idd5acd55a155bc43df7552135a44151bb2db38e9
> Reviewed-on: https://chromium-review.googlesource.com/1213204
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55745}

TBR=neis@chromium.org,petermarshall@chromium.org,dhai@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8133
Change-Id: I09b108e7844c598253fbbe02d705699c21308637
Reviewed-on: https://chromium-review.googlesource.com/1220286Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55802}

Bug: v8:7926
Change-Id: Idfc520b67696c8a838a0ee297ea392d416dd899e
Reviewed-on: https://chromium-review.googlesource.com/1206292
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55801}